This advisory covers six security vulnerabilities affecting TigerVNC and X.Org X server components (xwayland) in Red Hat Enterprise Linux 9.4 Extended Update Support. The issues include integer underflow leading to denial of service (CVE-2026-33999), out-of-bounds reads causing information disclosure and denial of service (CVE-2026-34000, CVE-2026-34002, CVE-2026-34003), a use-after-free vulnerability causing server crashes and potential memory corruption (CVE-2026-34001), and incorrect permissions in TigerVNC's x0vncserver leading to information disclosure, data manipulation, and denial of service (CVE-2026-34352). Red Hat has released security updates to address these vulnerabilities in the tigervnc package for Red Hat Enterprise Linux 9.4 EUS. The advisory references the Red Hat errata RHSA-2026:20575 for detailed patch information.

Successful exploitation of these vulnerabilities could result in denial of service conditions, information disclosure, potential memory corruption, and unauthorized data manipulation on affected systems running TigerVNC and X.Org X server components. The issues affect remote display functionality and could disrupt service availability or compromise confidentiality and integrity of data handled by the VNC server. The severity is rated as important by Red Hat, indicating significant impact but no known exploits in the wild at the time of the advisory.

Red Hat has released updated tigervnc packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply these official security updates promptly to remediate the issues. For detailed instructions on applying the updates, refer to the Red Hat advisory RHSA-2026:20575 and the update article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.